Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack
On Thursday, July 16, 2026, Woolwich Crown Court convicted Owen Flowers, 18, and Thalha Jubair, 20, to five and a half years each for the 2024 Transport for London hack.
All 27,000 employees of the transport authority were compelled to come into an office to have their credentials reset in person after the breach rendered 148 TfL systems unusable. TfL's losses and recovery expenses are estimated by the CPS and the NCA to be £29 million.
On June 22, 2026, the day their trial was scheduled to begin, both entered guilty pleas. They admitted to the charge, which was Section 3ZA of the Computer Misuse Act 1990, the most serious part of the Act, on the grounds that they were careless about whether they caused or created a considerable danger of serious harm to human welfare.
Flowers an...